CWE-79

In HT2 Labs Learning Locker 3.15.1, it’s possible to inject malicious HTML and JavaScript code into the DOM of the website via the PATH_INFO to the dashboards/ URI.

A reflected XSS on a user page was detected on one of the JetBrains TeamCity pages. The issue was fixed in TeamCity 2018.2.2.

SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) allows Stored HTML Injection by administrators via the Web Console Settings screen.

out/out.GroupMgr.php in SeedDMS 5.1.11 has Stored XSS by making a new group with a JavaScript payload as the “GROUP” Name.

Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS.

TYPO3 8.3.0 through 8.7.26 and 9.0.0 through 9.5.7 allows XSS.